diff --git a/nixos/system/hectic-lab/hectic-lab.nix b/nixos/system/hectic-lab/hectic-lab.nix
index 5476ea6e..c3a8e69a 100644
--- a/nixos/system/hectic-lab/hectic-lab.nix
+++ b/nixos/system/hectic-lab/hectic-lab.nix
@@ -48,6 +48,7 @@ let
giteaRunnerService = "gitea-runner-${giteaRunnerEscapedInstance}";
giteaRunnerTokenEnvService = "${giteaRunnerService}-token-env";
giteaRunnerTokenEnv = "/run/gitea-runner-${giteaRunnerInstance}/token.env";
+ worldOfSosalRoot = "/var/www/store/world-of-sosal";
in {
imports = [
self.nixosModules.hectic
@@ -341,6 +342,8 @@ in {
systemd.tmpfiles.rules = [
"d /var/www/store 0755 nginx nginx -"
+ "d ${worldOfSosalRoot} 0750 root nginx -"
+ "d ${worldOfSosalRoot}/releases 0750 root nginx -"
];
systemd.services.${giteaRunnerTokenEnvService} = {
@@ -385,6 +388,60 @@ in {
autoindex on;
'';
};
+ locations."= /world-of-sosal/" = {
+ extraConfig = ''
+ alias ${./static/world-of-sosal/index.html};
+ default_type text/html;
+ add_header Cache-Control "no-cache" always;
+ limit_except GET {
+ deny all;
+ }
+ '';
+ };
+ locations."= /world-of-sosal/latest.mrpack" = {
+ extraConfig = ''
+ root /var/www/store;
+ default_type application/zip;
+ add_header Content-Disposition "attachment" always;
+ add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+ try_files $uri =404;
+ if ($request_method != GET) { return 405; }
+ '';
+ };
+ locations."= /world-of-sosal/SHA256SUMS" = {
+ extraConfig = ''
+ root /var/www/store;
+ default_type text/plain;
+ add_header Content-Disposition "attachment" always;
+ add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+ try_files $uri =404;
+ if ($request_method != GET) { return 405; }
+ '';
+ };
+ locations."= /world-of-sosal/releases/" = {
+ extraConfig = ''
+ return 404;
+ '';
+ };
+ locations."~ ^/world-of-sosal/releases/[A-Za-z0-9][A-Za-z0-9._-]*\\.mrpack$" = {
+ extraConfig = ''
+ root /var/www/store;
+ default_type application/zip;
+ add_header Content-Disposition "attachment" always;
+ add_header Cache-Control "public, max-age=31536000, immutable" always;
+ try_files $uri =404;
+ if ($request_method != GET) { return 405; }
+ '';
+ };
+ locations."/world-of-sosal/" = {
+ extraConfig = ''
+ autoindex off;
+ limit_except GET {
+ deny all;
+ }
+ return 404;
+ '';
+ };
};
virtualHosts."lessons.${domain}" = {
enableACME = true;
diff --git a/nixos/system/hectic-lab/static/world-of-sosal/index.html b/nixos/system/hectic-lab/static/world-of-sosal/index.html
new file mode 100644
index 00000000..ed8173f8
--- /dev/null
+++ b/nixos/system/hectic-lab/static/world-of-sosal/index.html
@@ -0,0 +1,17 @@
+
+
+
+
+
+ WorldOfSosal
+
+
+
+ WorldOfSosal
+ Download latest pack
+ Import latest pack in Prism Launcher
+ SHA-256 checksums
+ Updates are manual. Packs imported from arbitrary URLs do not update automatically.
+
+
+
diff --git a/nixos/system/hectic-lab/world-of-sosal.md b/nixos/system/hectic-lab/world-of-sosal.md
new file mode 100644
index 00000000..95fe59d8
--- /dev/null
+++ b/nixos/system/hectic-lab/world-of-sosal.md
@@ -0,0 +1,52 @@
+# WorldOfSosal pack publishing
+
+The public endpoint is `https://store.hectic-lab.com/world-of-sosal/`. Nix
+deploys only its landing page and nginx configuration. Pack files, the checksum
+manifest, and `latest.mrpack` stay under `/var/www/store/world-of-sosal` on the
+host and never enter Git or the Nix store.
+
+## Publish an uploaded pack
+
+Run these commands on `hectic-lab` as root after the Storage Box pack has
+already been uploaded to a local staging path. Pick a stable version name; do
+not replace an existing versioned release.
+
+```sh
+set -eu
+source_pack=/path/to/already-uploaded/WorldOfSosal.mrpack
+version=2026-09-16
+root=/var/www/store/world-of-sosal
+release_name="WorldOfSosal-${version}.mrpack"
+release_path="$root/releases/$release_name"
+
+printf '%s %s\n' \
+ f8c18acb9208e4592725632ae50dab4f9c308483b34fd43a6507c74fdbf8169f \
+ "$source_pack" | sha256sum --check --status
+test ! -e "$release_path"
+install -o root -g nginx -m 0640 "$source_pack" "$release_path.new"
+mv -T "$release_path.new" "$release_path"
+
+manifest="$root/.SHA256SUMS.$$"
+(cd "$root/releases" && sha256sum -- *.mrpack) > "$manifest"
+chown root:nginx "$manifest"
+chmod 0640 "$manifest"
+mv -Tf "$manifest" "$root/SHA256SUMS"
+
+latest="$root/.latest.mrpack.$$"
+ln -s "releases/$release_name" "$latest"
+mv -Tf "$latest" "$root/latest.mrpack"
+```
+
+Versioned releases use a one-year immutable cache policy. `latest.mrpack` and
+`SHA256SUMS` disable caching so an atomic replacement becomes visible quickly.
+The manifest is available at
+`https://store.hectic-lab.com/world-of-sosal/SHA256SUMS`.
+
+Import the current pack in Prism Launcher with:
+
+```text
+prismlauncher://import?url=https%3A%2F%2Fstore.hectic-lab.com%2Fworld-of-sosal%2Flatest.mrpack
+```
+
+Direct URL imports do not auto-update. Repeat the publication and import steps
+for each new pack version.